Most Windows Server compromises do not need a zero-day: they use a service nobody needed, a legacy protocol nobody turned off, or an administrator credential left behind on a server that was never hardened. This guide covers how to harden Windows Server 2019, 2022 and 2025 member servers and role servers from a recognised baseline: choosing and applying a baseline, cutting the installed footprint, hardening protocols and remote administration, protecting credentials, and role-specific settings. It also covers rollout with audit-first testing, detection and the measures that show the work is holding. It is written for Windows infrastructure engineers, security architects and auditors. Domain controller and directory hardening has its own page, and workstation hardening is covered in the Windows Endpoint Hardening Guide; this page links to both rather than repeating them.
Key takeaways
- Start from a published baseline, then tailor by role. The Microsoft security baselines, OSConfig scenarios for Windows Server 2025 and the CIS Microsoft Windows Server Benchmarks give you hundreds of reviewed settings; your job is the documented exceptions, not reinventing them.
- Less installed means less to defend. Server Core, removing unused roles and features, and disabling services such as Print Spooler where they are not needed remove whole classes of exposure, including ones later found in the CISA Known Exploited Vulnerabilities catalogue.
- Legacy protocols are the soft middle. SMBv1, unsigned SMB and LDAP, NTLM and internet-exposed RDP are still the routes attackers use to relay, harvest and move laterally.
- Servers are where privileged credentials sit. Credential Guard, LSA protection, Windows LAPS, Restricted Admin or Remote Credential Guard for RDP and a tiered admin model decide whether one compromised server becomes a domain compromise.
- Hardening that is not measured drifts. Use drift control or compliance scanning, track baseline compliance and exceptions per role, and alert on the events that show settings being undone.
Choosing a baseline
Microsoft describes its security baselines as groups of Microsoft-recommended configuration settings with an explanation of their security impact, and recommends using a well-tested baseline rather than building your own. A Windows Server build has thousands of Group Policy settings; only a fraction are security relevant, and working out each value yourself is slow and error prone. In practice teams choose one primary source, keep a second for cross-checking, and record every deviation.
| Baseline source | Delivered as | Strengths | Watch out for |
|---|---|---|---|
| Microsoft security baselines (Security Compliance Toolkit) | GPO backups plus documentation spreadsheets, applied with Group Policy, Configuration Manager or Intune | Written by the vendor; separate member server and domain controller sets; conservative about breaking things | Deliberately does not enforce everything; you still need role-specific additions |
| OSConfig (Windows Server 2025) | PowerShell module Microsoft.OSConfig, Windows Admin Center, Azure Arc and Azure Policy machine configuration | Role scenarios applied locally with drift control that corrects changes automatically | Windows Server 2025 only; removal does not guarantee settings return to their previous values |
| CIS Microsoft Windows Server Benchmarks | Benchmark documents per version (2016 to 2025); GPO Build Kits for CIS SecureSuite members | Profiles for member servers and domain controllers at two levels; widely used by auditors | Level 2 settings break more applications; test before enforcing |
| DISA STIGs | Checklists and GPO packages | Mandatory for US defence systems; very detailed | Written for that context; many findings need local justification elsewhere |
For Windows Server 2025, OSConfig exposes the baseline as named scenarios: SecurityBaseline/WindowsServer/2025/MemberServer, SecurityBaseline/WindowsServer/2025/DomainController and SecurityBaseline/WindowsServer/2025/WorkgroupMember, plus SecuredCore, Defender/Antivirus/WindowsServer/2025 and LAPS/WindowsServer/2025/MemberServer. They are applied with Set-OSConfigDesiredConfiguration -Scenario <name> -Default, individual settings can be overridden with -Setting and -Value, and a restart is needed after applying. Drift control uses a refresh task to put back settings that have been changed, and Microsoft documents a precedence order where Azure Policy beats local configuration, which beats any other deployment tool. Decide which tool is authoritative before you switch it on, or Group Policy and OSConfig will fight.
- Small estates: apply the Microsoft baseline GPOs, add a handful of role GPOs and use the Policy Analyzer in the toolkit to compare what is applied against the baseline.
- Large or audited estates: pick CIS Level 1 (member server or domain controller profile) as the audit yardstick, implement it through Microsoft baseline GPOs plus a delta GPO, and keep an exceptions register mapped to each failed check.
- Hybrid and Azure Arc estates on Windows Server 2025: OSConfig with Azure Policy gives continuous enforcement and reporting without depending on Group Policy reaching the server.
Group Policy remains the delivery mechanism for most domain-joined servers, so securing it matters as much as the settings it carries. See the Group Policy Security Guide.
Reducing the installed footprint
Every role, feature and running service is code that can be attacked and must be patched. Reduce it before tuning anything else.
- Server Core by default: Microsoft describes Server Core as having a smaller disk footprint and smaller code base, which reduces the attack surface. It has no desktop shell, Explorer, Edge or Server Manager locally; administration happens through PowerShell, RSAT and Windows Admin Center from a privileged access workstation. Use Desktop Experience only for workloads that genuinely require it, and record why.
- One role per server: do not co-locate a web application with file shares, a certificate authority or a sync service. Mixed roles make the tier of the server ambiguous and the baseline a compromise.
- Remove, do not just stop: uninstall unused roles and features with
Uninstall-WindowsFeatureso they are not re-enabled or patched needlessly. Review the installed list at build and quarterly. - SMBv1: the
SMB1Protocolfeature is not installed by default on Windows Server 2019 and later. Where it still exists on older builds, turn onSet-SmbServerConfiguration -AuditSmb1Access $true, watch for event 3000 inMicrosoft-Windows-SMBServer/Audit, then remove the feature. CVE-2017-0144, the SMBv1 flaw used by WannaCry-era worms, is in the CISA KEV catalogue with known ransomware use. - Print Spooler: Microsoft's service guidance says the spooler is OK to disable if the server is not a print server or a domain controller, and notes that print pruning needs the spooler running on at least one DC per site. The PrintNightmare flaw (CVE-2021-34527) is a KEV entry with known ransomware use. See the Printer and Print Spooler Security Guide.
- Other services: the same Microsoft page lists consumer services that are safe to disable on servers, such as Bluetooth Support, Downloaded Maps Manager, Geolocation and the Xbox services. These are low risk but reduce noise in audits.
Protocols and remote administration
| Area | Hardened state | Setting or command | Test first |
|---|---|---|---|
| SMB signing | Required on client and server | Required by default on Windows Server 2025; on older versions set "Microsoft network server: Digitally sign communications (always)" and the client equivalent to Enabled | Third-party NAS and older Samba clients |
| LDAP signing and channel binding | Required on domain controllers; clients require signing | "Domain controller: LDAP server signing requirements" = Require signing; "Network security: LDAP client signing requirements" = Require signing; LDAP channel binding set to Always after audit | Events 2887 and 2889 in the Directory Service log show clients still binding unsigned |
| NTLM | Audited, then restricted to named exceptions | "Network security: Restrict NTLM" audit policies, then deny with an exception list | Legacy applications, appliances and services that authenticate by IP |
| RDP | Never internet facing; NLA on; admin access only from privileged workstations | Network Level Authentication required; firewall rule for TCP 3389 scoped to admin subnets or a gateway; Restricted Admin (mstsc /restrictedAdmin) or Remote Credential Guard (mstsc /remoteGuard) | Helpdesk tools that rely on full credential delegation |
| WinRM and PowerShell remoting | HTTPS or Kerberos only, scoped by firewall; Just Enough Administration for delegated tasks | TCP 5985/5986 inbound restricted to management hosts; PowerShell script block and module logging on | Monitoring and backup agents that use WinRM |
| Windows Defender Firewall | On for all profiles, default inbound block, rules per role | Firewall profile settings in the baseline GPO; local rule merge disabled on sensitive tiers | Applications that create their own rules at install |
Microsoft recommends keeping NLA enabled and not exposing Remote Desktop directly to the internet. CVE-2019-0708 (BlueKeep) is a pre-authentication RDP flaw in the KEV catalogue, and exposed RDP remains a leading ransomware entry route; see the Top 10 Ransomware Initial Access Vectors. Relay attacks against SMB and LDAP (ATT&CK T1557.001, Name Resolution Poisoning and SMB Relay) are blocked by signing, so plan the signing rollout together with NTLM reduction. See the SMB Signing Guide and NTLM Relay Guide.
Where identity fits: credentials on servers
Servers are where service accounts run and where administrators log on, so credential exposure on a member server is the usual step from foothold to domain. Credential theft from LSASS (T1003.001) and use of valid domain accounts (T1078.002) are the techniques this section blocks.
- Credential Guard: on Windows Server 2025 it is enabled by default when the server meets licensing and hardware requirements, is domain joined, is not a domain controller and has not been explicitly configured to disable it. The default is without UEFI lock. It isolates NTLM hashes, Kerberos TGTs and stored domain credentials in a virtualisation-based security container. Microsoft does not recommend it on domain controllers, and it does not protect the AD database or the SAM. On 2019 and 2022, enable it through the baseline where hardware allows.
- LSA protection: run LSASS as a protected process (
RunAsPPLunderHKLM\SYSTEM\CurrentControlSet\Control\Lsa) after auditing for drivers and plug-ins that fail to load. - Local administrator passwords: unique, rotated passwords through Windows LAPS; OSConfig ships a LAPS scenario for member servers. See the Local Administrator Password Solution (LAPS) Guide.
- Admin logons: use Restricted Admin or Remote Credential Guard so reusable credentials are not left on the target, put human administrators in Protected Users (never service or computer accounts, which then fail to authenticate) and enforce logon restrictions by tier. See the Tiered Administration and Enterprise Access Model Guide.
- Service accounts: replace domain user service accounts with group managed service accounts where the application supports them, deny interactive and RDP logon, and remove them from local Administrators unless proven necessary. Server-side secrets such as ASP.NET machine keys, certificate private keys and sync account credentials are non-human identities and need owners and rotation.
Platform protections: Secured-core and code integrity
Microsoft's Secured-core server definition groups hardware, firmware and OS protections in three pillars: a hardware root of trust (Secure Boot, TPM 2.0, Boot DMA protection), defence against firmware attacks (System Guard Secure Launch using DRTM, from Windows Server 2022) and protection against unverified code (virtualisation-based security and Hypervisor-protected Code Integrity, also called memory integrity). Buy certified hardware for new tier 0 and tier 1 hosts, enable the features in the baseline, and confirm HVCI driver compatibility on a pilot before broad rollout. For application control, App Control for Business (formerly WDAC) policies in audit mode first are well suited to servers because the software set is small and stable.
Role-specific hardening
| Role | Key additions beyond the baseline | Why |
|---|---|---|
| Domain controller | Use the DC baseline; LDAP signing and channel binding; Print Spooler handled per the pruning note; no other roles, no browsing, no agents beyond essentials; patch Netlogon promptly (CVE-2020-1472 is in KEV) | Compromise means domain compromise (DCSync, T1003.006). See the Active Directory and Entra ID Hardening Guide. |
| Identity sync and federation (Entra Connect, AD FS, AD CS) | Treat as tier 0: same admin model and logon restrictions as DCs; restricted outbound access; protect sync account credentials and signing keys | In the Storm-0501 attacks operators extracted Entra Connect Sync credentials and pivoted into the cloud tenant. See the Microsoft Entra Connect and Cloud Sync Hardening Guide. |
| Web servers (IIS, SharePoint, Exchange) | Only required IIS modules; application pool identities, not domain accounts; rotate ASP.NET machine keys after any suspected compromise; WAF or reverse proxy in front; emergency patching path | In the ToolShell SharePoint exploitation, stolen machine keys kept attackers inside after patching |
| File servers | SMB signing and, for sensitive shares, SMB encryption; access-based enumeration; share and NTFS permissions reviewed; file auditing on sensitive paths | Lateral movement over admin shares (T1021.002) and bulk data theft |
| Remote Desktop Services hosts | RD Gateway with MFA in front; session time limits; AppLocker or App Control for published apps; no admins logging on with tier 0 accounts | Many users and credentials share one host |
| Hyper-V hosts | Server Core; management on a separate network; host admins limited to the virtualisation tier; shielded VMs where needed | Host admin is effectively admin of every guest |
| Print servers | Point and Print restricted to approved servers; drivers from administrators only; keep off tier 0 | Spooler flaws are a recurring privilege escalation route |
Rolling it out
- Inventory and tier: list every server with its role, operating system version, owner and tier. Servers you cannot classify are your first finding.
- Choose the baseline and the authoritative tool: Group Policy, OSConfig, Configuration Manager or Azure Policy. One tool owns each setting.
- Audit before enforcing: enable SMBv1 access auditing, NTLM auditing, LDAP interface event logging (16 LDAP Interface Events set to 2) and App Control audit mode, and collect for at least one full business cycle including month-end.
- Pilot ring: apply the baseline to a small set per role, including one server per application team, with a named rollback owner.
- Broad rings by role and tier: roll out in waves, lowest risk roles first and tier 0 last but with the strictest settings. Use separate role GPOs so a problem in one role does not force a rollback for all.
- Rollback: keep the previous GPO backup or OSConfig scenario version, and know that removing an OSConfig baseline does not restore prior values, so record the pre-change state for settings you may need to revert.
- Bake into the build: apply the baseline in the image or deployment pipeline so new servers start compliant, then enforce drift control.
Detection and measurement
| Event | Log | What it tells you |
|---|---|---|
| 4624 (logon type 10) and 4625 | Security | RDP logons and failures; alert on tier 0 accounts logging on to lower-tier servers |
| 4672 | Security | Special privileges assigned at logon: where admin accounts are used |
| 4688 with command line | Security | Process creation; baseline normal processes per role |
| 4697 and 7045 | Security and System | New service installed, common in remote execution (T1569.002) |
| 4719 and 1102 | Security | Audit policy changed or log cleared: tampering with visibility |
| 3000 | Microsoft-Windows-SMBServer/Audit | SMBv1 client access attempts |
| 2887 and 2889 | Directory Service (DCs) | Unsigned or simple LDAP binds still in use |
Forward these to your SIEM and see the Windows Event Log Guide for audit policy. Measures that show hardening is working:
- Baseline compliance: percentage of servers passing the chosen baseline per role and tier (target 95 percent or better, tier 0 at 100 percent with documented exceptions).
- Exceptions: number of open baseline exceptions and how many are past their review date.
- Legacy protocols: count of hosts with SMBv1 installed and weekly volume of NTLM and unsigned LDAP authentications, trending to zero.
- Footprint: share of servers on Server Core and servers running Print Spooler without a print role.
- Credential exposure: servers without Credential Guard or LSA protection where hardware supports it, and LAPS coverage of member servers.
- Drift: number of settings corrected by drift control or flagged by compliance scans per month, by setting.
Framework mapping
| Framework | Reference | How server hardening supports it |
|---|---|---|
| NIST SP 800-53 Rev. 5 | CM-2 Baseline Configuration, CM-6 Configuration Settings, CM-7 Least Functionality, AC-6 Least Privilege, SI-2 Flaw Remediation, AU-12 Audit Record Generation | Documented baseline, enforced settings, removed functions, admin restrictions, patching, logging |
| NIST CSF 2.0 | PR.PS-01 configuration management practices; PR.PS-02 software maintained and removed; DE.CM-09 computing hardware and software monitored | Baselines, footprint reduction and event monitoring |
| CIS Controls v8.1 | Control 4 Secure Configuration of Enterprise Assets and Software (including 4.1 secure configuration process, 4.4 firewall on servers, 4.8 disable unnecessary services) | Baseline, firewall and service reduction |
| ISO/IEC 27001:2022 Annex A | A.8.9 Configuration management, A.8.8 Management of technical vulnerabilities, A.8.2 Privileged access rights, A.8.15 Logging | Evidence for configuration, patching, admin and logging controls |
| MITRE ATT&CK v20 | T1210 Exploitation of Remote Services, T1557.001, T1003.001, T1021.002, T1685 Disable or Modify Tools | Techniques the controls above block or detect |
Common failure patterns
- Baseline applied to workstations only: servers built years ago from a gold image that predates the baseline, never revisited because "they are behind the firewall".
- Exceptions that never close: one application needed NTLM or SMBv1 in 2019, so the setting was relaxed for the whole server OU and is still relaxed.
- Tier 0 servers treated as ordinary member servers: sync, federation and certificate servers managed by the general server team with general admin accounts, as the Storm-0501 attacks exploited.
- Patching without cleaning up: the vulnerability is patched but secrets stolen before the patch are left valid, as in the ToolShell SharePoint exploitation. Rotate keys and credentials on any server that may have been breached.
- Two tools fighting: Group Policy sets one value, OSConfig or a configuration management agent sets another, and compliance reports flap. Assign one owner per setting.
- Security agents excluded into uselessness: broad antivirus exclusions on database and Exchange servers copied from old vendor advice, giving attackers a safe folder.
Practitioner checklist
- Pick a primary baseline (Microsoft, OSConfig or CIS) and one authoritative tool per setting, and record it.
- Inventory every server with role, owner and tier; treat sync, federation, PKI and DCs as tier 0.
- Default new builds to Server Core and one role per server; remove unused roles and features.
- Remove SMBv1, require SMB and LDAP signing, audit then restrict NTLM.
- Disable Print Spooler where the server is neither a print server nor a DC needed for print pruning.
- Close RDP to the internet, require NLA, and use Restricted Admin or Remote Credential Guard from privileged workstations.
- Confirm Credential Guard and LSA protection on member servers, and Windows LAPS coverage.
- Roll out audit first, then pilot, then rings by role, with GPO backups for rollback.
- Forward the key events to the SIEM and report baseline compliance, exceptions and legacy protocol use monthly.
Standards and references
- Microsoft Learn: Windows security baselines
- Microsoft Learn: Deploy security baselines with OSConfig
- Microsoft Learn: Secured-core server
- Microsoft Learn: Credential Guard overview
- Microsoft Learn: Guidance on disabling system services on Windows Server
- CIS: Microsoft Windows Server Benchmarks
- NIST: SP 800-53 Rev. 5
- CISA: Known Exploited Vulnerabilities Catalog
Related NHI Mgmt Group resources: Windows Endpoint Hardening Guide · Linux Server Hardening Guide · Tiered Administration and Enterprise Access Model Guide · Group Policy Security Guide · Patch Management Guide